Here are my iptables rules to allow Squid to connect to a web server:
# Accept internally-requested input iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #http,https traffic only through Squid - nobody user iptables -A OUTPUT -p tcp -m multiport --dports 80,443 \ -m state -m owner --uid-owner nobody --state NEW,ESTABLISHED -j ACCEPT
Squid itself is listening 3128 port on localhost. In skype options I told it to use squid proxy and to use port 58215 for incoming connections. I added these lines for skype:
#skype incoming connections iptables -A INPUT -p udp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport 58215 -m state --state NEW,ESTABLISHED -j ACCEPT
But it didn't work.
Then I turned off the firewall:
iptables -P OUTPUT ACCEPT iptables -P INPUT ACCEPT
Skype started working. So, I looked, what ports does it use:
# netstat -a -ptcp | grep skype tcp 0 0 *:58215 *:* LISTEN 2944/skype tcp 0 0 pc.home.org:56369 126.96.36.199:40031 ESTABLISHED 2944/skype tcp 0 0 pc.home.org:54316 db3msgr5011307.ga:https ESTABLISHED 2944/skype tcp 0 0 pc.home.org:34778 188.8.131.52:12350 ESTABLISHED 2944/skype # netstat -a -pudp | grep skype udp 0 0 *:58215 *:* 2944/skype udp 0 0 localhost:42865 *:* 2944/skype
But when I set restrictive policy:
iptables -P OUTPUT DROP iptables -P INPUT DROP
Skype stops working. What should I do to make it work?